@lifeaitools/clauth 1.9.2 → 1.16.9

package/package.json

@@ -1,61 +1,65 @@
-{
-  "name": "@lifeaitools/clauth",
-  "version": "1.9.2",
-  "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
-  "type": "module",
-  "bin": {
-    "clauth": "./cli/index.js"
-  },
-  "scripts": {
-    "build": "bash scripts/build.sh",
-    "postinstall": "node scripts/postinstall.js",
-    "worker:start": "node cli/index.js serve",
-    "worker:stop": "curl -s http://127.0.0.1:52437/shutdown 2>nul || taskkill /F /IM cloudflared.exe 2>nul & exit 0",
-    "worker:restart": "npm run worker:stop && timeout /t 3 /nobreak >nul && npm run worker:start"
-  },
-  "dependencies": {
-    "chalk": "^5.3.0",
-    "commander": "^12.1.0",
-    "conf": "^13.0.0",
-    "inquirer": "^10.1.0",
-    "node-fetch": "^3.3.2",
-    "ora": "^8.1.0",
-    "@vscode/ripgrep": "^1.15.9",
-    "fast-glob": "^3.3.2"
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "keywords": [
-    "lifeai",
-    "credentials",
-    "vault",
-    "cli",
-    "prt"
-  ],
-  "author": "Dave Ladouceur <dave@life.ai>",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/LIFEAI/clauth.git"
-  },
-  "devDependencies": {
-    "javascript-obfuscator": "^5.3.0"
-  },
-  "files": [
-    "cli/",
-    "scripts/bin/",
-    "scripts/bootstrap.cjs",
-    "scripts/build.sh",
-    "scripts/postinstall.js",
-    "supabase/",
-    ".clauth-skill/",
-    "install.sh",
-    "install.ps1",
-    "README.md"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "homepage": "https://github.com/LIFEAI/clauth"
-}
+{
+  "name": "@lifeaitools/clauth",
+  "version": "1.16.9",
+  "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
+  "type": "module",
+  "bin": {
+    "clauth": "./cli/index.js"
+  },
+  "scripts": {
+    "build": "bash scripts/build.sh",
+    "test": "node --test cli/commands/scrub.test.js && node test-auth-verdict.mjs",
+    "test:agent-pool": "node test/agent-pool.test.mjs",
+    "test:call-agent-10": "node test/call-agent-10-skills.test.mjs",
+    "test:call-agent-guard": "node test/call-agent-guard.test.mjs",
+    "postinstall": "node scripts/postinstall.js",
+    "worker:start": "node cli/index.js serve",
+    "worker:stop": "curl -s http://127.0.0.1:52437/shutdown 2>nul || taskkill /F /IM cloudflared.exe 2>nul & exit 0",
+    "worker:restart": "npm run worker:stop && timeout /t 3 /nobreak >nul && npm run worker:start"
+  },
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "commander": "^12.1.0",
+    "conf": "^13.0.0",
+    "inquirer": "^10.1.0",
+    "node-fetch": "^3.3.2",
+    "ora": "^8.1.0",
+    "@vscode/ripgrep": "^1.15.9",
+    "fast-glob": "^3.3.2"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "keywords": [
+    "lifeai",
+    "credentials",
+    "vault",
+    "cli",
+    "prt"
+  ],
+  "author": "Dave Ladouceur <dave@life.ai>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/LIFEAI/clauth.git"
+  },
+  "devDependencies": {
+    "javascript-obfuscator": "^5.3.0"
+  },
+  "files": [
+    "cli/",
+    "scripts/bin/",
+    "scripts/bootstrap.cjs",
+    "scripts/build.sh",
+    "scripts/postinstall.js",
+    "supabase/",
+    ".clauth-skill/",
+    "install.sh",
+    "install.ps1",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "homepage": "https://github.com/LIFEAI/clauth"
+}

package/scripts/postinstall.js

@@ -1,164 +1,164 @@
-#!/usr/bin/env node
-// scripts/postinstall.js
-// Runs after npm install -g @lifeaitools/clauth
-// On Windows: writes watchdog.ps1 to %APPDATA%\clauth\ and registers
-// the Task Scheduler job via UAC elevation.
-
-import fs from "fs";
-import path from "path";
-import os from "os";
-import { fileURLToPath } from "url";
-import { spawnSync } from "child_process";
-
-const __dirname  = path.dirname(fileURLToPath(import.meta.url));
-const APPDATA    = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
-const CLAUTH_DIR = path.join(APPDATA, "clauth");
-const DEST_PS1   = path.join(CLAUTH_DIR, "watchdog.ps1");
-const SOURCE_PS1 = path.join(__dirname, "..", "cli", "assets", "watchdog.ps1");
-const PS_EXE     = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
-const TASK_NAME  = "ClautWatchdog";
-
-const CONFIG_DIR = os.platform() === "win32"
-  ? path.join(APPDATA, "clauth-nodejs", "Config")
-  : path.join(os.homedir(), ".config", "clauth-nodejs");
-
-let version = "1.0.0";
-try {
-  const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8"));
-  version = pkg.version;
-} catch {}
-
-// ----------------------------------------------------------------
-// Watchdog helpers (Windows only)
-// ----------------------------------------------------------------
-
-function writeWatchdogScript() {
-  try {
-    fs.mkdirSync(CLAUTH_DIR, { recursive: true });
-    fs.copyFileSync(SOURCE_PS1, DEST_PS1);
-    return true;
-  } catch (err) {
-    console.log(`  ! Could not write watchdog script: ${err.message}`);
-    return false;
-  }
-}
-
-function isWatchdogRegistered() {
-  try {
-    const r = spawnSync(PS_EXE, [
-      "-NoProfile", "-Command",
-      `(Get-ScheduledTask -TaskName '${TASK_NAME}' -ErrorAction SilentlyContinue) -ne $null`,
-    ], { encoding: "utf8", stdio: ["pipe","pipe","pipe"], timeout: 5000 });
-    return (r.stdout || "").trim().toLowerCase() === "true";
-  } catch { return false; }
-}
-
-function registerWatchdog() {
-  const escaped = DEST_PS1.replace(/'/g, "''");
-  const psCmd = [
-    `$a = New-ScheduledTaskAction -Execute 'powershell.exe'`,
-    ` -Argument '-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${escaped}\\"';`,
-    `$t = New-ScheduledTaskTrigger -AtLogOn;`,
-    `$s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit 0 -RestartCount 3`,
-    ` -RestartInterval (New-TimeSpan -Minutes 1) -MultipleInstances IgnoreNew;`,
-    `Unregister-ScheduledTask -TaskName '${TASK_NAME}' -Confirm:$false -ErrorAction SilentlyContinue;`,
-    `Register-ScheduledTask -TaskName '${TASK_NAME}' -Action $a -Trigger $t`,
-    ` -Settings $s -RunLevel Highest -Description 'clauth daemon watchdog';`,
-  ].join(" ");
-
-  // Try direct first (works if already running as Administrator)
-  const direct = spawnSync(PS_EXE, [
-    "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", psCmd,
-  ], { encoding: "utf8", stdio: ["pipe","pipe","pipe"], timeout: 10000 });
-
-  if (direct.status === 0) return "ok";
-
-  // Trigger UAC elevation — opens the Windows approval dialog
-  const inner = psCmd.replace(/"/g, '\\"');
-  const elevated = spawnSync(PS_EXE, [
-    "-NoProfile", "-Command",
-    `Start-Process '${PS_EXE}' -Verb RunAs -Wait -ArgumentList '-NoProfile -ExecutionPolicy Bypass -Command "${inner}"'`,
-  ], { stdio: "inherit", encoding: "utf8", timeout: 60000 });
-
-  return elevated.status === 0 ? "ok" : "denied";
-}
-
-function startWatchdog() {
-  spawnSync(PS_EXE, [
-    "-NoProfile", "-Command",
-    `Start-ScheduledTask -TaskName '${TASK_NAME}' -ErrorAction SilentlyContinue`,
-  ], { stdio: "pipe", timeout: 5000 });
-}
-
-function installCodevelopTerminalProfiles() {
-  const cli = path.join(__dirname, "..", "cli", "index.js");
-  const result = spawnSync(process.execPath, [
-    cli,
-    "codevelop",
-    "install-terminal",
-    "--repo",
-    "C:\\Dev\\regen-root",
-  ], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 10000 });
-
-  if (result.status === 0) {
-    console.log("  ✓ Co-development Windows Terminal profiles installed");
-  } else {
-    const msg = (result.stderr || result.stdout || "").trim();
-    console.log(`  ! Co-development terminal profile install skipped${msg ? `: ${msg}` : ""}`);
-    console.log("    Install later with: clauth codevelop install-terminal --repo C:\\Dev\\regen-root");
-  }
-}
-
-// ----------------------------------------------------------------
-// Main
-// ----------------------------------------------------------------
-
-async function main() {
-  const configPath = path.join(CONFIG_DIR, "config.json");
-  const isUpgrade  = fs.existsSync(configPath);
-
-  if (isUpgrade) {
-    console.log(`\n  \u2713 clauth upgraded to v${version}`);
-    console.log(`  \u2713 Config preserved at ${CONFIG_DIR}`);
-    try {
-      const controller = new AbortController();
-      const to = setTimeout(() => controller.abort(), 2000);
-      const res = await fetch("http://127.0.0.1:52437/ping", { signal: controller.signal });
-      clearTimeout(to);
-      if (res.ok) console.log("  \u21BB Daemon running \u2014 restart: clauth serve restart");
-    } catch {
-      console.log("  \u25CB Daemon not running");
-    }
-  } else {
-    console.log(`\n  Welcome to clauth v${version}!`);
-    console.log("  Run 'clauth install' to set up your vault");
-  }
-
-  // Windows: register watchdog on fresh install; refresh script on upgrade
-  if (os.platform() === "win32") {
-    const registered = isWatchdogRegistered();
-    if (!registered) {
-      console.log("\n  Setting up auto-restart watchdog...");
-      console.log("  Windows will ask for administrator approval \u2014 please click Yes.\n");
-      if (writeWatchdogScript()) {
-        const result = registerWatchdog();
-        if (result === "ok") {
-          startWatchdog();
-          console.log("  \u2713 Watchdog registered and started (Task: ClautWatchdog)");
-          console.log(`  \u2713 Script: ${DEST_PS1}`);
-        } else {
-          console.log("  ! Watchdog registration skipped (approval denied).");
-          console.log("    Install later with: clauth watchdog install");
-        }
-      }
-    } else {
-      writeWatchdogScript(); // refresh script on upgrade
-      console.log("  \u2713 Watchdog script updated");
-    }
-    installCodevelopTerminalProfiles();
-  }
-
-  console.log("  Run 'clauth doctor' to verify installation\n");
-}
-
-main().catch(() => {});
+#!/usr/bin/env node
+// scripts/postinstall.js
+// Runs after npm install -g @lifeaitools/clauth
+// On Windows: writes watchdog.ps1 to %APPDATA%\clauth\ and registers
+// the Task Scheduler job via UAC elevation.
+
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { fileURLToPath } from "url";
+import { spawnSync } from "child_process";
+
+const __dirname  = path.dirname(fileURLToPath(import.meta.url));
+const APPDATA    = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+const CLAUTH_DIR = path.join(APPDATA, "clauth");
+const DEST_PS1   = path.join(CLAUTH_DIR, "watchdog.ps1");
+const SOURCE_PS1 = path.join(__dirname, "..", "cli", "assets", "watchdog.ps1");
+const PS_EXE     = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
+const TASK_NAME  = "ClautWatchdog";
+
+const CONFIG_DIR = os.platform() === "win32"
+  ? path.join(APPDATA, "clauth-nodejs", "Config")
+  : path.join(os.homedir(), ".config", "clauth-nodejs");
+
+let version = "1.0.0";
+try {
+  const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8"));
+  version = pkg.version;
+} catch {}
+
+// ----------------------------------------------------------------
+// Watchdog helpers (Windows only)
+// ----------------------------------------------------------------
+
+function writeWatchdogScript() {
+  try {
+    fs.mkdirSync(CLAUTH_DIR, { recursive: true });
+    fs.copyFileSync(SOURCE_PS1, DEST_PS1);
+    return true;
+  } catch (err) {
+    console.log(`  ! Could not write watchdog script: ${err.message}`);
+    return false;
+  }
+}
+
+function isWatchdogRegistered() {
+  try {
+    const r = spawnSync(PS_EXE, [
+      "-NoProfile", "-Command",
+      `(Get-ScheduledTask -TaskName '${TASK_NAME}' -ErrorAction SilentlyContinue) -ne $null`,
+    ], { encoding: "utf8", stdio: ["pipe","pipe","pipe"], timeout: 5000 });
+    return (r.stdout || "").trim().toLowerCase() === "true";
+  } catch { return false; }
+}
+
+function registerWatchdog() {
+  const escaped = DEST_PS1.replace(/'/g, "''");
+  const psCmd = [
+    `$a = New-ScheduledTaskAction -Execute 'powershell.exe'`,
+    ` -Argument '-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${escaped}\\"';`,
+    `$t = New-ScheduledTaskTrigger -AtLogOn;`,
+    `$s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit 0 -RestartCount 3`,
+    ` -RestartInterval (New-TimeSpan -Minutes 1) -MultipleInstances IgnoreNew;`,
+    `Unregister-ScheduledTask -TaskName '${TASK_NAME}' -Confirm:$false -ErrorAction SilentlyContinue;`,
+    `Register-ScheduledTask -TaskName '${TASK_NAME}' -Action $a -Trigger $t`,
+    ` -Settings $s -RunLevel Highest -Description 'clauth daemon watchdog';`,
+  ].join(" ");
+
+  // Try direct first (works if already running as Administrator)
+  const direct = spawnSync(PS_EXE, [
+    "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", psCmd,
+  ], { encoding: "utf8", stdio: ["pipe","pipe","pipe"], timeout: 10000 });
+
+  if (direct.status === 0) return "ok";
+
+  // Trigger UAC elevation — opens the Windows approval dialog
+  const inner = psCmd.replace(/"/g, '\\"');
+  const elevated = spawnSync(PS_EXE, [
+    "-NoProfile", "-Command",
+    `Start-Process '${PS_EXE}' -Verb RunAs -Wait -ArgumentList '-NoProfile -ExecutionPolicy Bypass -Command "${inner}"'`,
+  ], { stdio: "inherit", encoding: "utf8", timeout: 60000 });
+
+  return elevated.status === 0 ? "ok" : "denied";
+}
+
+function startWatchdog() {
+  spawnSync(PS_EXE, [
+    "-NoProfile", "-Command",
+    `Start-ScheduledTask -TaskName '${TASK_NAME}' -ErrorAction SilentlyContinue`,
+  ], { stdio: "pipe", timeout: 5000 });
+}
+
+function installCodevelopTerminalProfiles() {
+  const cli = path.join(__dirname, "..", "cli", "index.js");
+  const result = spawnSync(process.execPath, [
+    cli,
+    "codevelop",
+    "install-terminal",
+    "--repo",
+    "C:\\Dev\\regen-root",
+  ], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 10000 });
+
+  if (result.status === 0) {
+    console.log("  ✓ Co-development Windows Terminal profiles installed");
+  } else {
+    const msg = (result.stderr || result.stdout || "").trim();
+    console.log(`  ! Co-development terminal profile install skipped${msg ? `: ${msg}` : ""}`);
+    console.log("    Install later with: clauth codevelop install-terminal --repo C:\\Dev\\regen-root");
+  }
+}
+
+// ----------------------------------------------------------------
+// Main
+// ----------------------------------------------------------------
+
+async function main() {
+  const configPath = path.join(CONFIG_DIR, "config.json");
+  const isUpgrade  = fs.existsSync(configPath);
+
+  if (isUpgrade) {
+    console.log(`\n  \u2713 clauth upgraded to v${version}`);
+    console.log(`  \u2713 Config preserved at ${CONFIG_DIR}`);
+    try {
+      const controller = new AbortController();
+      const to = setTimeout(() => controller.abort(), 2000);
+      const res = await fetch("http://127.0.0.1:52437/ping", { signal: controller.signal });
+      clearTimeout(to);
+      if (res.ok) console.log("  \u21BB Daemon running \u2014 restart: clauth serve restart");
+    } catch {
+      console.log("  \u25CB Daemon not running");
+    }
+  } else {
+    console.log(`\n  Welcome to clauth v${version}!`);
+    console.log("  Run 'clauth install' to set up your vault");
+  }
+
+  // Windows: register watchdog on fresh install; refresh script on upgrade
+  if (os.platform() === "win32") {
+    const registered = isWatchdogRegistered();
+    if (!registered) {
+      console.log("\n  Setting up auto-restart watchdog...");
+      console.log("  Windows will ask for administrator approval \u2014 please click Yes.\n");
+      if (writeWatchdogScript()) {
+        const result = registerWatchdog();
+        if (result === "ok") {
+          startWatchdog();
+          console.log("  \u2713 Watchdog registered and started (Task: ClautWatchdog)");
+          console.log(`  \u2713 Script: ${DEST_PS1}`);
+        } else {
+          console.log("  ! Watchdog registration skipped (approval denied).");
+          console.log("    Install later with: clauth watchdog install");
+        }
+      }
+    } else {
+      writeWatchdogScript(); // refresh script on upgrade
+      console.log("  \u2713 Watchdog script updated");
+    }
+    installCodevelopTerminalProfiles();
+  }
+
+  console.log("  Run 'clauth doctor' to verify installation\n");
+}
+
+main().catch(() => {});

package/supabase/migrations/001_clauth_schema.sql

@@ -27,18 +27,18 @@ create table if not exists public.clauth_services (
 -- ============================================================
 -- Machine Registry (hardware fingerprints — hashed only)
 -- ============================================================
-create table if not exists public.clauth_machines (
-  id              uuid primary key default gen_random_uuid(),
-  install_id      text not null default 'default', -- logical vault install / owner group
-  machine_hash    text not null unique,          -- SHA256(machine_id + os_install_id)
-  label           text,                          -- e.g. 'Dave-Desktop-Win11'
-  hmac_seed_hash  text not null,                 -- SHA256 of the HMAC seed stored in vault
-  enabled         boolean not null default true,
-  fail_count      integer not null default 0,
-  locked          boolean not null default false,
-  created_at      timestamptz not null default now(),
-  last_seen       timestamptz
-);
+create table if not exists public.clauth_machines (
+  id              uuid primary key default gen_random_uuid(),
+  install_id      text not null default 'default', -- logical vault install / owner group
+  machine_hash    text not null unique,          -- SHA256(machine_id + os_install_id)
+  label           text,                          -- e.g. 'Dave-Desktop-Win11'
+  hmac_seed_hash  text not null,                 -- SHA256 of the HMAC seed stored in vault
+  enabled         boolean not null default true,
+  fail_count      integer not null default 0,
+  locked          boolean not null default false,
+  created_at      timestamptz not null default now(),
+  last_seen       timestamptz
+);
 
 -- ============================================================
 -- Audit Log

package/supabase/migrations/003_clauth_config.sql

@@ -1,13 +1,13 @@
--- clauth_config: key/value store for daemon configuration
--- Used to persist tunnel hostname and other daemon settings
-CREATE TABLE IF NOT EXISTS clauth_config (
-  key        text PRIMARY KEY,
-  value      jsonb NOT NULL,
-  updated_at timestamptz DEFAULT now()
-);
-
--- RLS: only service role can access (same pattern as other clauth tables)
-ALTER TABLE clauth_config ENABLE ROW LEVEL SECURITY;
-
--- Seed: no tunnel by default (user must run clauth tunnel setup)
--- INSERT INTO clauth_config (key, value) VALUES ('tunnel_hostname', 'null');
+-- clauth_config: key/value store for daemon configuration
+-- Used to persist tunnel hostname and other daemon settings
+CREATE TABLE IF NOT EXISTS clauth_config (
+  key        text PRIMARY KEY,
+  value      jsonb NOT NULL,
+  updated_at timestamptz DEFAULT now()
+);
+
+-- RLS: only service role can access (same pattern as other clauth tables)
+ALTER TABLE clauth_config ENABLE ROW LEVEL SECURITY;
+
+-- Seed: no tunnel by default (user must run clauth tunnel setup)
+-- INSERT INTO clauth_config (key, value) VALUES ('tunnel_hostname', 'null');

package/supabase/migrations/003_machine_enrollments.sql

@@ -1,39 +1,39 @@
--- ============================================================
--- clauth machine enrollment
--- Migration: 003_machine_enrollments.sql
--- ============================================================
-
-alter table public.clauth_machines
-  add column if not exists install_id text not null default 'default';
-
-create index if not exists clauth_machines_install_id_idx
-  on public.clauth_machines (install_id);
-
-create table if not exists public.clauth_machine_enrollments (
-  id uuid primary key default gen_random_uuid(),
-  install_id text not null default 'default',
-  token_hash text not null unique,
-  label text,
-  created_by_machine_hash text not null references public.clauth_machines(machine_hash) on delete cascade,
-  redeemed_by_machine_hash text references public.clauth_machines(machine_hash) on delete set null,
-  expires_at timestamptz not null,
-  consumed_at timestamptz,
-  created_at timestamptz not null default now()
-);
-
-create index if not exists clauth_machine_enrollments_install_idx
-  on public.clauth_machine_enrollments (install_id, expires_at);
-
-alter table public.clauth_machine_enrollments enable row level security;
-
-do $$ begin
-  if not exists (
-    select 1
-    from pg_policies
-    where policyname = 'no_anon_machine_enrollments'
-      and tablename = 'clauth_machine_enrollments'
-  ) then
-    create policy "no_anon_machine_enrollments"
-      on public.clauth_machine_enrollments for all using (false);
-  end if;
-end $$;
+-- ============================================================
+-- clauth machine enrollment
+-- Migration: 003_machine_enrollments.sql
+-- ============================================================
+
+alter table public.clauth_machines
+  add column if not exists install_id text not null default 'default';
+
+create index if not exists clauth_machines_install_id_idx
+  on public.clauth_machines (install_id);
+
+create table if not exists public.clauth_machine_enrollments (
+  id uuid primary key default gen_random_uuid(),
+  install_id text not null default 'default',
+  token_hash text not null unique,
+  label text,
+  created_by_machine_hash text not null references public.clauth_machines(machine_hash) on delete cascade,
+  redeemed_by_machine_hash text references public.clauth_machines(machine_hash) on delete set null,
+  expires_at timestamptz not null,
+  consumed_at timestamptz,
+  created_at timestamptz not null default now()
+);
+
+create index if not exists clauth_machine_enrollments_install_idx
+  on public.clauth_machine_enrollments (install_id, expires_at);
+
+alter table public.clauth_machine_enrollments enable row level security;
+
+do $$ begin
+  if not exists (
+    select 1
+    from pg_policies
+    where policyname = 'no_anon_machine_enrollments'
+      and tablename = 'clauth_machine_enrollments'
+  ) then
+    create policy "no_anon_machine_enrollments"
+      on public.clauth_machine_enrollments for all using (false);
+  end if;
+end $$;